20260615-linuxkm-fixes by douzzer · Pull Request #10696 · wolfSSL/wolfssl

douzzer · 2026-06-16T05:14:03Z

fixes for false positives on linuxkm CONFIG_FORTIFY_SOURCE builds on gcc-16:

linuxkm/linuxkm_memory.c: use packed-struct intermediates rather than memcpy()s for wc_get_unaligned() and wc_put_unaligned().

linuxkm/linuxkm_wc_port.h: on old FIPS, retrofit nonnull attribute to GHASH() arg 1, so that it unconditionally writes out the hash.

wolfcrypt/src/aes.c and wolfssl/wolfcrypt/aes.h: in GHASH(), add nonnull attribute to arg 1, and remove runtime nullness check for arg 1 in the implementations.

linuxkm/lkcapi_sha_glue.c: refactor error code handling in wc_linuxkm_drbg_generate() (followup to 3c9996e in #10688).

wolfcrypt/src/aes.c: fix performance regressions on GMAC and AES-CFB decrypt:

add WC_VAES_MIN_BLOCKS, WC_VAES_ECB_MIN_BLOCKS, and WC_VAES_GCM_MIN_BLOCKS, and check against them before using AVX512/VAES implementations.
in AesCfbDecrypt_C(), enlarge the tmp[] buffer and parameterize its size with newly added WC_AES_CFB_DEC_BUF_BLOCKS.

src/include.am: remove wolfcrypt/src/aes_x86_64_asm.S from AESNI source lists in FIPS v2/v5/v6 sections.

in all FIPS-relevant C sources, add a "#define _WC_BUILDING_foo" first (where foo is a stylization of the filename), before including libwolfssl_sources.h, to allow future file-specific suppressions or other settings without altering FIPS sources.

wolfcrypt/src/aes.c, wolfcrypt/src/port/, wolfssl/wolfcrypt/aes.h, wolfcrypt/src/pkcs7.c, wolfcrypt/test/test.c:

implement wc_local_AesGcmCheckTagSz() with pedantic checks for valid authtag size. SP 800-38D restrictions are now uniformly imposed, unless WC_AES_GCM_ALLOW_NONSTANDARD_TAG_LENGTH is defined (not allow with FIPS).
refactor tag size checks in wc_AesGcmEncrypt(), wc_AesGcmDecrypt(), wc_AesGcmEncryptFinal(), wc_AesGcmDecryptFinal(), and wc_PKCS7_DecodeAuthEnvelopedData().
in test.c, update aesgcm_non12iv_test() to skip tag sizes expected to fail.

wolfcrypt/test/test.c:

in slhdsa_keygen_kat() and slhdsa_id_label_test(), pass devId to wc_SlhDsaKey_Init*()
in cryptocb_test(), inhibit the callback verification check for SLHDSA if FIPS (no crypto callbacks in FIPS-wrapped calls).

linuxkm/x86_vector_register_glue.c, linuxkm/linuxkm_wc_port.h, wolfssl/wolfcrypt/memory.h: add WC_SVR_FLAG_FUZZ, implement support for DEBUG_VECTOR_REGISTER_ACCESS_FUZZING directly in the save/restore implementations, and properly reflect existing save state there and in the _FUZZING variants of ``SAVE_VECTOR_REGISTERS2().

wolfcrypt/src/sha3.c: refactor WC_C_DYNAMIC_FALLBACK using ``SAVE_VECTOR_REGISTERS2().

clean up setup code for kernel modules:

configure.ac:

remove -DWC_SHA3_NO_ASM from ENABLED_LINUXKM AM_CFLAGS.
refactor initial setup for KERNEL_MODE_DEFAULTS, adding generic --enable-kernel-settings while retaining legacy --enable-linuxkm-defaults.
rename $DEF_SP_MATH to $DEF_SP_MATH_ALL.
remove redundant and unneeded setup for KERNEL_MODE_DEFAULTS and ENABLED_LINUXKM (leverage existing setup in settings.h).
move some still-needed KERNEL_MODE_DEFAULTS and ENABLED_LINUXKM setup from configure.ac to settings.h.
set up -DWOLFSSL_KERNEL_MODE_DEFAULTS, so that settings.h can pivot on it.

wolfssl/wolfcrypt/settings.h:

revise WOLFSSL_LINUXKM section of settings.h to require WOLFSSL_MIN_AUTH_TAG_SZ at least 8 for old FIPS and 12 for new FIPS. still force down to 4 bytes if crypto fuzzer is enabled, otherwise force down to 8 to support legacy IPsec ESP.
in the WOLFSSL_LINUXKM section, don't set WC_MLKEM_NO_ASM, and disable DEBUG_VECTOR_REGISTER_ACCESS_FUZZING in ML-KEM, ML-DSA, and SLH-DSA -- intelasm works right, but fuzzing doesn't (yet).
add hard compile-time assert in settings.h for FIPS v7+ asserting that WOLFSSL_MIN_AUTH_TAG_SZ meets SP 800-38D Rev 1 requirements.

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: add linuxkm-pie support for CheckOcspResponder() (WOLFSSL_NO_OCSP_ISSUER_CHECK is no longer implied by KERNEL_MODE_DEFAULTS).

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: on kernel >= 7.2, remove indirect symbol support for strncpy and add backward-compat implementation wc_linuxkm_strncpy().

replace several nonconformant uses of __FUNCTION__ with func (linuxkm/linuxkm_memory.c, wolfcrypt/src/random.c, wolfcrypt/test/test.c, wolfssl/wolfcrypt/mem_track.h, wolfssl/wolfcrypt/memory.h, wolfssl/wolfcrypt/settings.h).

wolfcrypt/src/port/riscv/riscv-64-aes.c: in GHASH(), remove runtime nullness check for arg 1 (matching nonnull attribute to arg 1 added to prototype in earlier commit).

wolfcrypt/src/wc_slhdsa.c:

disable asm accelerations if WC_SHA3_NO_ASM is set.
fix an uninited-data warning in slhdsakey_wots_pkgen_chain_c().

linuxkm-related loose ends:

wolfssl/ocsp.h: gate out the CheckOcspResponder() prototype if defined(CheckOcspResponder) (for linuxkm-pie).
wolfcrypt/src/wc_mldsa.c: add support for WC_MLDSA_NO_ASM.
.wolfssl_known_macro_extras: add new macros.

tweaks for linuxkm targeting clang-built kernels:

linuxkm/: when logging ``PTR_ERR(), cast it to int, and use "%d" as the format. Globally, `#define `PTR_ERR`(x) ((int)`PTR_ERR`(x))` in `linuxkm_wc_port.h` to fix clang warnings on kernel headers.

linuxkm/lkcapi_aes_glue.c: add casts in linuxkm_test_aesgcm() to mollify clang.

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c:

add clang compat code to allow including clang stdatomic.h while masking out kernel-incompatible __CLANG_STDINT_H.
add clang-specific suppressions for kernel headers (-Wshorten-64-to-32, -Wframe-address).

linuxkm/lkcapi_sha_glue.c:

in wc__get_random_bytes(), add bounds-checking for len.
in wc_extract_crng_user(), fix type conflicts.

wolfssl/wolfcrypt/wc_port.h and wolfssl/wolfcrypt/types.h:

move the old-FIPS compatibility mapping from INLINE to WC_INLINE from types.h to wc_port.h.
activate stdatomic.h for clang kernel module builds.

linuxkm/Kbuild:

add clang-specific flags.
add gcc gate around gcc-specific flags.
allow override value for MAX_STACK_FRAME_SIZE.

wolfcrypt/src/asn.c: add casts in GetFormattedTime_ex() to mollify clang build of linuxkm.

tested with

wolfssl-multi-test.sh ...
pr-check
'.*linuxkm.*'

github-actions · 2026-06-16T05:21:19Z

MemBrowse Memory Report

gcc-arm-cortex-m3

FLASH: .text +4 B (+0.0%, 121,413 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4-openssl-compat

FLASH: .text +64 B (+0.0%, 768,196 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pkcs7

FLASH: .text +64 B (+0.0%, 211,437 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-pq

FLASH: .text +64 B (+0.0%, 278,000 B / 1,048,576 B, total: 27% used)

linuxkm-pie

Data: __patchable_function_entries +896 B (+3.7%, 25,184 B)

linuxkm-standard

Data: __patchable_function_entries +1,776 B (+3.9%, 47,784 B)
No memory changes detected for:
gcc-arm-cortex-m0plus
gcc-arm-cortex-m4
gcc-arm-cortex-m4-baremetal
gcc-arm-cortex-m4-crypto-only
gcc-arm-cortex-m4-dtls13
gcc-arm-cortex-m4-min-ecc
gcc-arm-cortex-m4-rsa-only
gcc-arm-cortex-m4-sp-math
gcc-arm-cortex-m4-tls12
gcc-arm-cortex-m4-tls13
gcc-arm-cortex-m7
gcc-arm-cortex-m7-pq
gcc-arm-cortex-m7-tls13
stm32-sim-stm32h753

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10696

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

douzzer · 2026-06-17T03:06:55Z

retest this please
(unrelated FIPS glitch)

philljj · 2026-06-17T17:21:04Z

Nice, this fixes linuxkm-aesni-insmod-kmemleak gcc-16 false positive failure on master.

philljj

Tests good, just some nits in review.

philljj · 2026-06-17T18:34:31Z

+                                            unsigned int cSz, unsigned char* s, unsigned int sSz);
+        #else
+            struct Gcm;
+            WOLFSSL_LOCAL void __attribute__((nonnull(1))) GHASH(struct Gcm *gcm, const unsigned char* a,


dumb question, is this redundant with the change in aes.h?

Also can WC_ARG_NOT_NULL be used here?

Not on old FIPS -- that's what it's for.

And WC_ARG_NOT_NULL doesn't exist yet when linuxkm_wc_port.h is evaluated, alas. That's why it's also using unsigned char * instead of byte *, etc.

philljj · 2026-06-17T18:37:05Z

        if (unlikely(ret == WC_NO_ERR_TRACE(RNG_FAILURE_E))) {
-            if (slen > 0) {
-                ret = -EINVAL;
+            if (slen > 0)


nit: could condense this to if (slen > 0 || retried) break; now.

Of if they are worth being separate checks, maybe a short 1 line comment explaining what slen > 0 vs retried means in error conditions.

Need to be separate so that instrumentation (--enable-debug-trace-errcodes) shows what failed.

IIRC, the slen situation isn't retryable because the whole point of a gen paired with a seed is to have the seed deterministically determine what's gen'd, which it wouldn't if a reinit were done midstream. This could be bikeshedded to work right on reinit but clearly isn't worth the extra trouble.

…gcc-16: linuxkm/linuxkm_memory.c: use packed-struct intermediates rather than memcpy()s for wc_get_unaligned() and wc_put_unaligned(). linuxkm/linuxkm_wc_port.h: on old FIPS, retrofit nonnull attribute to GHASH() arg 1, so that it unconditionally writes out the hash. wolfcrypt/src/aes.c and wolfssl/wolfcrypt/aes.h: in GHASH(), add nonnull attribute to arg 1, and remove runtime nullness check for arg 1 in the implementations.

…_drbg_generate() (followup to 3c9996e in wolfSSL#10688).

…decrypt: * add WC_VAES_MIN_BLOCKS, WC_VAES_ECB_MIN_BLOCKS, and WC_VAES_GCM_MIN_BLOCKS, and check against them before using AVX512/VAES implementations. * in AesCfbDecrypt_C(), enlarge the tmp[] buffer and parameterize its size with newly added WC_AES_CFB_DEC_BUF_BLOCKS.

…ce lists in FIPS v2/v5/v6 sections.

…t (where foo is a stylization of the filename), before including libwolfssl_sources.h, to allow future file-specific suppressions or other settings without altering FIPS sources.

…lfcrypt/src/pkcs7.c, wolfcrypt/test/test.c: * implement wc_local_AesGcmCheckTagSz() with pedantic checks for valid authtag size. SP 800-38D restrictions are now uniformly imposed, unless WC_AES_GCM_ALLOW_NONSTANDARD_TAG_LENGTH is defined (not allow with FIPS). * refactor tag size checks in wc_AesGcmEncrypt(), wc_AesGcmDecrypt(), wc_AesGcmEncryptFinal(), wc_AesGcmDecryptFinal(), and wc_PKCS7_DecodeAuthEnvelopedData(). * in test.c, update aesgcm_non12iv_test() to skip tag sizes expected to fail.

* in slhdsa_keygen_kat() and slhdsa_id_label_test(), pass devId to wc_SlhDsaKey_Init*() * in cryptocb_test(), inhibit the callback verification check for SLHDSA if FIPS (no crypto callbacks in FIPS-wrapped calls).

…l/wolfcrypt/memory.h: add WC_SVR_FLAG_FUZZ, implement support for DEBUG_VECTOR_REGISTER_ACCESS_FUZZING directly in the save/restore implementations, and properly reflect existing save state there and in the _FUZZING variants of SAVE_VECTOR_REGISTERS2().

…R_REGISTERS2().

configure.ac: * remove -DWC_SHA3_NO_ASM from ENABLED_LINUXKM AM_CFLAGS. * refactor initial setup for KERNEL_MODE_DEFAULTS, adding generic --enable-kernel-settings while retaining legacy --enable-linuxkm-defaults. * rename $DEF_SP_MATH to $DEF_SP_MATH_ALL. * remove redundant and unneeded setup for KERNEL_MODE_DEFAULTS and ENABLED_LINUXKM (leverage existing setup in settings.h). * move some still-needed KERNEL_MODE_DEFAULTS and ENABLED_LINUXKM setup from configure.ac to settings.h. * set up -DWOLFSSL_KERNEL_MODE_DEFAULTS, so that settings.h can pivot on it. wolfssl/wolfcrypt/settings.h: * revise WOLFSSL_LINUXKM section of settings.h to require WOLFSSL_MIN_AUTH_TAG_SZ at least 8 for old FIPS and 12 for new FIPS. still force down to 4 bytes if crypto fuzzer is enabled, otherwise force down to 8 to support legacy IPsec ESP. * in the WOLFSSL_LINUXKM section, don't set WC_MLKEM_NO_ASM, and disable DEBUG_VECTOR_REGISTER_ACCESS_FUZZING in ML-KEM, ML-DSA, and SLH-DSA -- intelasm works right, but fuzzing doesn't (yet).

…hat WOLFSSL_MIN_AUTH_TAG_SZ meets SP 800-38D Rev 1 requirements.

…pport for CheckOcspResponder() (WOLFSSL_NO_OCSP_ISSUER_CHECK is no longer implied by KERNEL_MODE_DEFAULTS).

…remove indirect symbol support for strncpy and add backward-compat implementation wc_linuxkm_strncpy().

…uxkm/linuxkm_memory.c, wolfcrypt/src/random.c, wolfcrypt/test/test.c, wolfssl/wolfcrypt/mem_track.h, wolfssl/wolfcrypt/memory.h, wolfssl/wolfcrypt/settings.h).

…ullness check for arg 1 (matching nonnull attribute to arg 1 added to prototype in earlier commit).

* disable asm accelerations if WC_SHA3_NO_ASM is set. * fix an uninited-data warning in slhdsakey_wots_pkgen_chain_c().

* wolfssl/ocsp.h: gate out the CheckOcspResponder() prototype if defined(CheckOcspResponder) (for linuxkm-pie). * wolfcrypt/src/wc_mldsa.c: add support for WC_MLDSA_NO_ASM. * .wolfssl_known_macro_extras: add new macros.

linuxkm/: when logging PTR_ERR(), cast it to int, and use "%d" as the format. Globally, `#define PTR_ERR(x) ((int)PTR_ERR(x))` in linuxkm_wc_port.h to fix clang warnings on kernel headers. linuxkm/lkcapi_aes_glue.c: add casts in linuxkm_test_aesgcm() to mollify clang. linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: * add __clang__ compat code to allow including clang stdatomic.h while masking out kernel-incompatible __CLANG_STDINT_H. * add clang-specific suppressions for kernel headers (-Wshorten-64-to-32, -Wframe-address). linuxkm/lkcapi_sha_glue.c: * in wc__get_random_bytes(), add bounds-checking for len. * in wc_extract_crng_user(), fix type conflicts. wolfssl/wolfcrypt/wc_port.h and wolfssl/wolfcrypt/types.h: * move the old-FIPS compatibility mapping from INLINE to WC_INLINE from types.h to wc_port.h. * activate stdatomic.h for clang kernel module builds. linuxkm/Kbuild: * add clang-specific flags. * add gcc gate around gcc-specific flags. * allow override value for MAX_STACK_FRAME_SIZE. wolfcrypt/src/asn.c: add casts in GetFormattedTime_ex() to mollify clang build of linuxkm.

github-actions · 2026-06-27T19:49:57Z

retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #10696

Scan targets checked: linuxkm-bugs, linuxkm-src, wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-06-27T20:32:44Z

+        }
+        return dstart;
+    }
+    #define strncpy wc_linuxkm_strncpy


🔵 [Low] strncpy redirect silently drops zero-fill guarantee · API contract violations

#define strncpy wc_linuxkm_strncpy transparently substitutes all strncpy calls (kernel >= 7.2.0), but the reimplementation null-terminates after a short source without zero-filling the rest of the buffer, leaving trailing bytes uninitialized. Callers relying on the standard zero-fill contract read garbage.

Fix: Either zero-fill the remaining bytes to match strncpy semantics, or redirect under a wolfSSL-specific name rather than the standard strncpy.

Deliberate -- as explained in the implementation,

/* don't bother zero-filling dst. */

wolfSSL-Fenrir-bot · 2026-06-27T20:32:44Z

-                WOLFSSL_MSG("AuthEnvelopedData GCM authTag too small");
-                ret = ASN_PARSE_E;
+                     encOID == AES256GCMb)) {
+                ret = wc_local_AesGcmCheckTagSz(authTagSz);


🟠 [Medium] wc_local_AesGcmCheckTagSz() called unguarded in PKCS7 CCM-capable path · Switch fallthrough bugs (conditional compilation)

wc_local_AesGcmCheckTagSz is declared (aes.h:618) and defined (aes.c) only under #ifdef HAVE_AESGCM, but this call site is not #ifdef-guarded while wc_PKCS7_DecodeAuthEnvelopedData compiles under HAVE_AESGCM || HAVE_AESCCM. A CCM-only PKCS7 build fails with implicit-declaration / undefined-reference. The prior code used the always-defined macro WOLFSSL_MIN_AUTH_TAG_SZ.

Fix: Wrap the GCM tag-size check in #ifdef HAVE_AESGCM (or otherwise guard the call so CCM-only builds compile).

…date AES*GCMb with !HAVE_AESGCM, and add AES-CCM authTagSz check.

…AesGcmCheckTagSz() with C++ (namespace breakage).

douzzer · 2026-06-27T23:38:10Z

retest this please
(resume test failed in "CAVP self test")

…date old FIPS using old authTagSz check.

…atest FIPS; tests/api.c: use WOLFSSL_FILETYPE_PEM, not SSL_FILETYPE_PEM; tests/api/test_dtls.c and tests/api/test_dtls13.c: use WOLFSSL_ERROR_WANT_READ, not SSL_ERROR_WANT_READ.

douzzer · 2026-06-28T05:35:07Z

retest this please
(Jenkins tooling glitch on PRB-python-port)

douzzer requested review from philljj, wolfSSL-Bot and wolfSSL-Fenrir-bot June 16, 2026 05:14

douzzer assigned wolfSSL-Bot Jun 16, 2026

douzzer added the Not For This Release Not for release 5.9.2 label Jun 16, 2026

wolfSSL-Fenrir-bot reviewed Jun 16, 2026

View reviewed changes

Comment thread linuxkm/lkcapi_sha_glue.c

philljj assigned douzzer Jun 16, 2026

douzzer force-pushed the 20260615-linuxkm-fixes branch from abfe536 to 2844cd1 Compare June 16, 2026 17:29

douzzer commented Jun 16, 2026

View reviewed changes

Comment thread linuxkm/lkcapi_sha_glue.c

douzzer removed their assignment Jun 17, 2026

philljj requested changes Jun 17, 2026

View reviewed changes

philljj assigned douzzer Jun 17, 2026

douzzer requested a review from philljj June 17, 2026 19:20

dgarske removed the request for review from wolfSSL-Bot June 25, 2026 19:05

douzzer marked this pull request as draft June 25, 2026 19:07

douzzer added 12 commits June 26, 2026 14:25

linuxkm/lkcapi_sha_glue.c: refactor error code handling in wc_linuxkm…

d4eaeb1

…_drbg_generate() (followup to 3c9996e in wolfSSL#10688).

src/include.am: remove wolfcrypt/src/aes_x86_64_asm.S from AESNI sour…

300f58d

…ce lists in FIPS v2/v5/v6 sections.

in all FIPS-relevant C sources, add a "#define _WC_BUILDING_foo" firs…

6d21d60

…t (where foo is a stylization of the filename), before including libwolfssl_sources.h, to allow future file-specific suppressions or other settings without altering FIPS sources.

wolfcrypt/test/test.c:

4d46e1e

* in slhdsa_keygen_kat() and slhdsa_id_label_test(), pass devId to wc_SlhDsaKey_Init*() * in cryptocb_test(), inhibit the callback verification check for SLHDSA if FIPS (no crypto callbacks in FIPS-wrapped calls).

wolfcrypt/src/sha3.c: refactor WC_C_DYNAMIC_FALLBACK using SAVE_VECTO…

7a40256

…R_REGISTERS2().

* add hard compile-time assert in settings.h for FIPS v7+ asserting t…

948ba6e

…hat WOLFSSL_MIN_AUTH_TAG_SZ meets SP 800-38D Rev 1 requirements.

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: add linuxkm-pie su…

538262a

…pport for CheckOcspResponder() (WOLFSSL_NO_OCSP_ISSUER_CHECK is no longer implied by KERNEL_MODE_DEFAULTS).

douzzer added 6 commits June 27, 2026 14:34

linuxkm/linuxkm_wc_port.h, linuxkm/module_hooks.c: on kernel >= 7.2, …

bf088df

…remove indirect symbol support for strncpy and add backward-compat implementation wc_linuxkm_strncpy().

replace several nonconformant uses of __FUNCTION__ with __func__ (lin…

649197d

…uxkm/linuxkm_memory.c, wolfcrypt/src/random.c, wolfcrypt/test/test.c, wolfssl/wolfcrypt/mem_track.h, wolfssl/wolfcrypt/memory.h, wolfssl/wolfcrypt/settings.h).

wolfcrypt/src/port/riscv/riscv-64-aes.c: in GHASH(), remove runtime n…

cba6909

…ullness check for arg 1 (matching nonnull attribute to arg 1 added to prototype in earlier commit).

wolfcrypt/src/wc_slhdsa.c:

ac5f2b9

* disable asm accelerations if WC_SHA3_NO_ASM is set. * fix an uninited-data warning in slhdsakey_wots_pkgen_chain_c().

linuxkm-related loose ends:

3811ec0

* wolfssl/ocsp.h: gate out the CheckOcspResponder() prototype if defined(CheckOcspResponder) (for linuxkm-pie). * wolfcrypt/src/wc_mldsa.c: add support for WC_MLDSA_NO_ASM. * .wolfssl_known_macro_extras: add new macros.

douzzer force-pushed the 20260615-linuxkm-fixes branch from 2844cd1 to 262b0ed Compare June 27, 2026 19:49

douzzer removed the Not For This Release Not for release 5.9.2 label Jun 27, 2026

douzzer marked this pull request as ready for review June 27, 2026 19:49

douzzer requested a review from wolfSSL-Fenrir-bot June 27, 2026 19:49

douzzer removed their assignment Jun 27, 2026

douzzer requested a review from SparkiDev June 27, 2026 20:04

wolfSSL-Fenrir-bot reviewed Jun 27, 2026

View reviewed changes

douzzer added 2 commits June 27, 2026 16:13

wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommo…

47cf8d0

…date AES*GCMb with !HAVE_AESGCM, and add AES-CCM authTagSz check.

wolfcrypt/src/aes.c: don't use explicit inline attribute on wc_local_…

d69d49c

…AesGcmCheckTagSz() with C++ (namespace breakage).

douzzer force-pushed the 20260615-linuxkm-fixes branch from 642c614 to d69d49c Compare June 27, 2026 21:15

douzzer added 2 commits June 27, 2026 19:50

wolfcrypt/src/pkcs7.c: in wc_PKCS7_DecodeAuthEnvelopedData(), accommo…

568c660

…date old FIPS using old authTagSz check.

wolfssl/wolfcrypt/wc_port.h: keep #define INLINE WC_INLINE even for l…

8452f2b

…atest FIPS; tests/api.c: use WOLFSSL_FILETYPE_PEM, not SSL_FILETYPE_PEM; tests/api/test_dtls.c and tests/api/test_dtls13.c: use WOLFSSL_ERROR_WANT_READ, not SSL_ERROR_WANT_READ.

Uh oh!

Conversation

douzzer commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10696

Uh oh!

Uh oh!

Uh oh!

douzzer commented Jun 17, 2026

Uh oh!

philljj commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

douzzer Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 27, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #10696

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

douzzer commented Jun 27, 2026

Uh oh!

douzzer commented Jun 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

douzzer commented Jun 16, 2026 •

edited

Loading

github-actions Bot commented Jun 16, 2026 •

edited

Loading

philljj commented Jun 17, 2026 •

edited

Loading

douzzer Jun 17, 2026 •

edited

Loading